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1. (Currently amended) A method for assembling fragmented 
network traffic, comprising: 

detecting, by a monitoring node, an anomaly in the 
fragmented network traffic whereby two or more fragments 
within the fragmented network traffic have overlapping 

offsets; 

initiating expanded buffering of fragments contained 
in said fragmented network traffic in response to detecting 
the anomaly; 

performing a query to determine configuration 
information associated with how a destination node to which 
the two or more fragments are addressed is configured to 
reassemble overlapping fragments; 

determining whether the two or more fragments could be 
assembled differently by a monitoring node and the 
destination node; and 

output ting the determination. 

detecting in the f ragmenteed - netewerk traffic an anomaly 

that could result in two or more fragments contained in the 

frag m ented netweg-k traffic being reassembled at a 

m e ni-feo - ff-ing node fee ebfcai an & - re a a a ombl cd date flow that ie 

different than a corresponding data as reassembled ate a 

de e %4« ' at -ir@ ii - node fee wh-fcett fe fee - fepagmonted network a-e 

addressed; 
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i-ea-fe-i-a-fe -i ae ; «i — geepeaec ■ to defee e fe - ±»g- ea - id anomaly 

expanded buffering of fragments contained ±a e-a-i# 

fragmented network - traffic; and 

p e . g .. f . e i CT j. l B: < g a query to dotcrm - i -a e con f igH-gatea-eR 

information aaoooiatcd with how the ■<flegfrwM»fc ' ±OR node i 

con f igured fe-<=> roaooctnbl c ov er I app i ng fragment a . 
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